Application-Based Data Storage Rights Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data storage access management systems often provide users with excessive permissions, leading to security risks, as they focus on user-by-user permissions rather than application-based rights, making it laborious to manage and update access rights effectively.
Innovation Solution
Implementing a system that controls data storage access based on application-application rights and application-storage rights, eliminating the need for user-by-user permissions by using rights tables to manage access through application programs, allowing updates and modifications without individual user oversight.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user-by-user data storage rights are provided with extensive permissions, then users have sufficient access to complete their work functions, but security risks increase and excessive permissions are granted beyond what is necessary
Solution Approach 1:
The patent segments data storage rights management into two distinct layers: application-level rights (what data storage operations an application can perform) and user-level rights (which applications a user can access). This segmentation allows the system to grant minimal necessary permissions at each level, preventing excessive permissions while maintaining operational capability. The rights are divided into read rights, write rights, and delete rights at the application level, and application access rights at the user level.
Solution Approach 2:
The patent introduces an intermediary rights management system that sits between users and data storage operations. Instead of directly granting users access to data storage with extensive permissions, the system uses application programs as intermediaries. Users access data storage only through authorized applications, which themselves have limited rights to specific data storage operations. This intermediary layer enables indirect access control, reducing security risks while maintaining user productivity.
2Object-affected harmful factors
If user-by-user data storage rights are tightly limited and provided as-needed, then security is improved and excessive permissions are reduced, but management becomes laborious and difficult to update
Solution Approach 1:
The patent extracts user-specific permissions from the rights management system and replaces them with application-based rights. Instead of managing individual user permissions for each data storage operation, the system extracts and manages only application-level rights and user-application access rights. This extraction significantly reduces management complexity while maintaining security, as rights updates only require modifying application permissions rather than individual user permissions.
Solution Approach 2:
The patent creates universal application-level rights that can be applied to multiple users simultaneously. Each application program is granted specific rights to data storage operations (read, write, delete) that apply to all users who access that application. This universality allows a single rights configuration to serve multiple users, greatly simplifying management and updates while maintaining tight security controls.
3Adaptability or versatility
If extensive user-by-user permissions are granted, then users can execute all necessary functions, but the number of permissions exceeds the minimum necessary requiring significant management oversight
Solution Approach 1:
The patent implements dynamic rights management where application programs can request additional data storage rights as needed based on actual operational requirements. Instead of statically granting all possible permissions upfront, the system allows applications to dynamically acquire rights through requests to the data storage system. This dynamic approach ensures users have adaptability to execute necessary functions while minimizing the number of permissions granted at any given time, reducing management overhead.
Data Source
AI summary
A method for controlling access to data storage based on application rights dictating usage ability of a user includes: receiving, by a first application of a computing device, a data access request from a second application of the computing device, the data access request including a user identifier, namespace identifier, application identifier associated with the second application, and data command; verifying data access authorization for a user of the second application and for the second application program based on a first permission stored in an application-application rights table associated with the user identifier, application identifier, the data command; verifying data access authorization for the first application based on a second permission stored in an application-storage rights table associated with the namespace identifier and data command; executing the data command to read from or write data to a data storage interfaced with the computing device associated with the namespace identifier.